Adversarial Example Defense: Ensembles of Weak Defenses are not Strong

By Warren He, James Wei, Xinyun Chen, Nicholas Carlini, Dawn Song. 2017

210 citations recorded by the source corpus.

Subfields: Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Safety, Robustness & Interpretability

Citations in the corpus

Towards Deep Learning Models Resistant to Adversarial Attacks (2017, background): “Examples include defensive distillation [24, 6], feature squeezing [31, 14], and several other adversarial example detection approaches [5].”
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks (2019, background): “A number of defenses have been proposed [43], [44], [45], [46], [47], yet many have shown to be less effective against an adaptive adversary [48], [49], [50], [51].”
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks (2018, background): “A variety of defenses against adversarial inputs have been proposed [37,13] and broken [20,9,5]; research into defenses that provide strong guarantees of robustness is ongoing.”
Adversarial Examples: Attacks and Defenses for Deep Learning (2017, neutral): “After investigating several defensive approaches, [128]”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, methodology): “[76] also combined feature squeezing with the ensemble method proposed in [173] to show that strength of defenses does not”
Disentangling Adversarial Robustness and Generalization (2018, methodology): “Defenses: Proposed defenses include detection and rejection methods [31, 25, 54, 60, 3, 63], pre-processing, quantization and dimensionality reduction methods [12, 73, 7], manifold-projection methods [39, 72, 82, 86], methods based on stochasticity/regularization or adapted architectures [109, 7, 68”
Towards Fast Computation of Certified Robustness for ReLU Networks (2018, background): “Indeed, many of these defensive mechanism have been shown to be ineffective when more advanced attacks are used (Carlini & Wagner, 2017c;a;b; He et al., 2017).”
AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning (2018, background): “Randomizing predictions or deploying multiple classifiers is also ineffective [11, 37].”
Adversarial Active Learning for Deep Networks: a Margin Based Approach (2018, methodology): “(Carlini & Wagner, 2017b; He et al., 2017; Carlini & Wagner, 2017a) methods are among the hardest attacks to counter.”
Trojaning Attack on Neural Networks (2018, background): “[32] explore how to bypass some weak defenses and show that the ensemble of weak defenses is also not strong.”
On Adaptive Attacks to Adversarial Example Defenses (2020, background): “Ensembles of weak defenses still appear weak (He et al., 2017).”
Learning Universal Adversarial Perturbations with Generative Models (2017, unknown): “[10] W.”